Yahoo notifies users of sophisticated breach methods

AFP, SAN FRANCISCO: Yahoo said Wednesday it was notifying some users that hackers may have been able to use a maneuver to break into their accounts without stealing passwords.
The latest notifications were in response to the record breach disclosed late last year affecting an estimated one billion users -- which involved forging of "cookies" or files used to authenticate users when they log into their accounts.
The notification indicates the investigation into the attacks are in the final stage, according to a source familiar with the matter, noting that messages had been sent to "a reasonably final list" of Yahoo users. A Yahoo spokesman said the company was notifying all potentially affected users and that it had "invalidated" the forged cookies.
"As we have previously disclosed, our outside forensic experts have been investigating the creation of forged cookies that could have enabled an intruder to access our users' accounts without a password," the company said in a statement.
"The investigation has identified user accounts for which we believe forged cookies were taken or used.

Yahoo notifies users of sophisticated breach methods

AFP, SAN FRANCISCO: Yahoo said Wednesday it was notifying some users that hackers may have been able to use a maneuver to break into their accounts without stealing passwords. The latest notifications were in response to the record breach disclosed late last year affecting an estimated one billion users -- which involved forging of cookies or files used to authenticate users when they log into their accounts. The notification indicates the investigation into the attacks are in the final stage, according to a source familiar with the matter, noting that messages had been sent to a reasonably final list of Yahoo users. A Yahoo spokesman said the company was notifying all potentially affected users and that it had invalidated the forged cookies. As we have previously disclosed, our outside forensic experts have been investigating the creation of forged cookies that could have enabled an intruder to access our users accounts without a password, the company said in a statement. The investigation has identified user accounts for which we believe forged cookies were taken or used.